Mustang Panda Uses LNK, PowerShell Chain to Deploy PlugX RAT

Mustang Panda is using a fake “Browser Updater” and a multi‑stage LNK–PowerShell loader to sideload PlugX through a legitimate G DATA antivirus binary, ultimately beaconing over HTTPS to a hard‑coded C2 while hiding configuration and strings behind layered encryption and API hashing. Mustang Panda is a China‑nexus APT group, long associated with PlugX remote access […]

The post Mustang Panda Uses LNK, PowerShell Chain to Deploy PlugX RAT appeared first on GBHackers Security | #1 Globally Trusted Cyber Security News Platform.

This article has been indexed from GBHackers Security | #1 Globally Trusted Cyber Security News Platform

Read the original article: